Stack-Based Buffer Overflow in Tenda W12 and i24 Products
CVE-2025-3803

8.7HIGH

Key Information:

Vendor: Tenda
Status: W12; I24
Vendor: CVE Published:; 19 April 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A severe vulnerability exists in Tenda's W12 and i24 products stemming from a stack-based buffer overflow in the cgiSysScheduleRebootSet function, located in the /bin/httpd file. This flaw is triggered by manipulating the rebootDate argument, which can be exploited remotely, potentially leading to unauthorized control over affected devices. The issue has been publicly disclosed, raising significant concerns regarding product security.

Affected Version(s)

i24 3.0.0.4(2887)

i24 3.0.0.5(3644)

W12 3.0.0.4(2887)

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-3803 - Proof of Concept